Privacy Policy
Effective 9 July 2026
Safe Welkin Limited ("Safe Welkin Limited", "we", "us" or "our"), a company registered in England & Wales, operates the DeCompass AI-powered compliance platform (the "Platform"). This Privacy Policy explains how we handle personal data when you visit our website, create an account, or use the Platform, and describes your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the Data (Use and Access) Act 2025.
1. Who we are
Safe Welkin Limited is the data controller for personal data processed about our website visitors, account holders and prospective customers. We are registered with the UK Information Commissioner's Office (ICO). For any privacy question, contact our Data Protection team at [email protected].
Where you use the Platform to process personal data about your own staff, customers or third parties, you are the controller and Safe Welkin Limited acts as your processor. That relationship is governed by our Data Processing Agreement.
2. The personal data we collect
Account & identity data — name, work email, job title, organisation, and hashed authentication credentials.
Usage & device data — pages visited, features used, IP address, browser and device type, and log timestamps.
Billing data — company billing details and subscription records (card details are handled by our payment processor, not stored by us).
Support & communications — messages you send us and records of correspondence.
Cookies & similar technologies — as described in our Cookie Policy.
3. How we use personal data and our lawful basis
We do not carry out automated decision making, see below our purpose of processing and lawful basis:
Purpose | Lawful basis |
|---|---|
Providing and administering your account and the Platform | Performance of a contract |
Securing the Platform, preventing fraud and abuse | Legitimate interests |
Billing and collecting payment | Performance of a contract / legal obligation |
Product analytics and improvement | Legitimate interests |
Marketing communications (where opted in) | Consent |
Complying with legal and regulatory obligations | Legal obligation |
4. Sharing your data
We share personal data only with vetted sub-processors who help us run the Platform (hosting, email delivery, payment processing and analytics), with professional advisers, and with authorities where required by law. A current list is maintained on our Sub-processors page. We never sell personal data.
5. International transfers
Our primary hosting is within the UK/EEA. Where data is transferred outside the UK, we rely on adequacy regulations or the International Data Transfer Agreement (IDTA)/Standard Contractual Clauses with appropriate safeguards.
6. Retention
We keep personal data only as long as necessary for the purposes above and to meet legal obligations, as set out in our Data Retention & Deletion Policy. Account data is deleted or anonymised within 5 - 7 years after account closure, for storage sake.
7. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. To exercise any right, email [email protected]. You also have the right to complain to the ICO (ico.org.uk), though we would welcome the chance to resolve concerns first.
8. Security
We apply technical and organisational measures aligned with ISO/IEC 27001, including encryption in transit and at rest, access controls and continuous monitoring. See our Information Security Statement.
9. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the Platform or by email. The "effective" date above reflects the latest revision.
10. Contact
Safe Welkin Limited, England & Wales — [email protected].
© 2026 DeCompass. This document is provided for information and does not constitute legal advice.